CVE-2026-86158: Progress Software Progress Telerik Fiddler Everywhere

High severity, CVSS 7.7. EPSS: 0.1% chance of exploitation in the next 30 days.

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

Affected products

• Progress Software Progress Telerik Fiddler Everywhere: from 1.0.0, before 8.2.0 (fixed in 8.2.0)

Published 2026-09-29. Last modified 2026-09-30.